System and method for using agent-based distributed reasoning to manage a computer network

Abstract

The present invention describes a system and method for using agent-based distributed reasoning to manage a computer network. In particular, the system includes interface agents to integrate event streams, distributed reasoning agents, and response agents, which run on hosts in the network. An interface agent monitors a resource in the network and reports an event to an appropriate distributed reasoning agent. The distributed reasoning agent, using one or more knowledge bases, determines a response to the event. An appropriate response agent implements the response. Characteristics of the reasoning agent's mean that they can work together collaboratively, as well as implementing parallel algorithms.

Description

FIELD OF THE INVENTION [0001] The present invention relates to systems and methods for using agent-based distributed reasoning to manage computer networks. In particular, the present invention relates to systems and methods that use agents and distributed reasoning to detect a situation occurring within a computer network by analyzing events, determining whether they relate to situations that require automated response, and automatically responding to the event based on the analysis. BACKGROUND OF THE INVENTION [0002] In the following discussion certain articles and methods will be described for background and introductory purposes. Nothing contained herein is to be construed as an “admission” of prior art. Applicant expressly reserves the right to demonstrate, where appropriate, that the articles and methods referenced herein do not constitute prior art under the applicable statutory provisions. [0003] Recent cyber-attacks on major corporate and government computer networks and Wor...

AI Technical Summary

Benefits of technology

[0006] Given the above-stated shortcomings and limitations of existing network management and security tools, there has been an increased interest in developing a mechanism that links a variety of network management and security tools to event-response functions and that allows multiple tools to be used together in a coordinated

Problems solved by technology

Such attacks cost organizations resources, time and money.

These tools, however, suffer from many shortcomings.

Among these shortcomings, a lack of interoperability has limited effectiveness of a network management scheme based on these tools.

However, because they are typically designed to operate independently of each other, they are neither interoperable nor capable of cooperating with each other.

This lack of interoperability results in important system and security information being placed in numerous locations within a computer network, placing an undue burden on network administrators, who are forced to monitor a variety of data and reports.

Further, the lack of interoperability increases a risk of overlooking important situations.

Since there is currently no effective tool

Images